Project

General

Profile

Bug #12629

Feature #5630: Reproducible builds

Document reproducible release process

Added by u 4 months ago. Updated 15 days ago.

Status:
In Progress
Priority:
Elevated
Assignee:
Category:
-
Target version:
Start date:
06/02/2017
Due date:
% Done:

10%

QA Check:
Feature Branch:
Type of work:
Contributors documentation
Blueprint:
Easy:
Affected tool:

Description

We need to update the release process documentation to take care of reproducible ISOs and IUKs.


Related issues

Duplicated by Tails - Feature #12628: Draft a "user" (aka. RM) story for the reproducible release process Duplicate 06/02/2017

Associated revisions

Revision 2ca22f37 (diff)
Added by intrigeri 3 months ago

Release process: fetch the ISO from Jenkins and ensure it matches the signature created by the release manager (refs: #12629).

Revision 69c1263b
Added by intrigeri 3 months ago

Merge branch 'doc/12629-reproducible-release-process' (refs: #12629).

History

#1 Updated by u 4 months ago

  • Related to Feature #12628: Draft a "user" (aka. RM) story for the reproducible release process added

#2 Updated by intrigeri 4 months ago

  • Status changed from New to Confirmed

#3 Updated by intrigeri 3 months ago

  • Target version set to Tails_3.2

I see two main aspects here, that I'll discuss first for ISOs and then for IUKs.

For the ISO image:

  • ensure at least N entities produced the same ISO: developers laptop? CI infra? where do we set the bar?
  • avoid having to upload the ISO at release time, and while we're at it, fix the "Upload images" section of the release process doc )AFAIK no RM has actually followed it as-is since years); so, instead of pretending we seed the ISO and then copy it from bittorrent.lizard to rsync.lizard, we should probably instead:
    • scp the detached signature to rsync.lizard
    • ssh rsync.lizard and wget the ISO built by Jenkins
    • verify the detached signature
    • scp the Torrent to bittorrent.lizard
    • ssh bittorrent.lizard, wget the ISO built by Jenkins, add to Transmission

For IUKs:

  • "ensure at least N entities produced the same" still applies, modulo we don't build them on our CI so only developers can reproduce them;
  • regarding publication, it's a bit more subtle since we don't build them on our CI so one needs to upload them (which apparently is not documented yet BTW).

Out of personal interest I might give "avoid having to upload the ISO" a try during the 3.0 release process, in which case I'll probably draft the needed changes in a branch; then anonym can test & polish them.

#4 Updated by intrigeri 3 months ago

  • Status changed from Confirmed to In Progress
  • % Done changed from 0 to 10
  • Feature Branch set to doc/12629-reproducible-release-process

Draft written and tested for the ISO publication. I'll push once I've tested the bits about the IUKs and Torrent.

#5 Updated by intrigeri 3 months ago

Pushed! My branch addresses the "ensure at least N entities produced the same" part, but the other part is left as an exercise to the reader^W^Wanonym :)

#6 Updated by intrigeri 3 months ago

  • Related to deleted (Feature #12628: Draft a "user" (aka. RM) story for the reproducible release process)

#7 Updated by intrigeri 3 months ago

  • Duplicated by Feature #12628: Draft a "user" (aka. RM) story for the reproducible release process added

#8 Updated by intrigeri 3 months ago

  • Feature Branch deleted (doc/12629-reproducible-release-process)

The updated doc on the branch has worked fine during the 3.0.1 release process, so I'm merging it. This is not everything this ticket is about though.

#9 Updated by intrigeri 15 days ago

  • Priority changed from Normal to Elevated

It would be nice if this was drafted in time to be tested while releasing 3.2~rc1, so we can polish it as needed and test a final version during the 3.2 release process.

#10 Updated by intrigeri 15 days ago

anonym plans to do this post-3.2-freeze.

Also available in: Atom PDF